PT-2026-94748

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the md module where md start sync checks for spare configuration changes before acquiring the reconfig mutex. Because the rdev state can change before the mute...

PT-2026-94749

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the md personalities that can block internally, where the support for REQ NOWAIT is incomplete. While read operations can avoid certain blocking paths, write requests...

PT-2026-94624

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the md/md-llbitmap component where the llbitmap destroy function deletes the pending timer before flushing the md llbitmap io wq workqueue. Because daemon work may sti...

PT-2026-94625

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the md/md-llbitmap component. The llbitmap create function publishes mddev-bitmap before reading the bitmap superblock. If the llbitmap read sb...

CVE-2026-90278: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md: wait for behind writes before destroying bitmap mdstop destroyed the bitmap before calling mddevdetach. That made mddevdetach skip bitmapops-waitbehindwrites, because the bitmap was already disconnected from mddev. This was...

CVE-2026-90277: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: prevent create failure bitmap UAF llbitmapcreate publishes mddev-bitmap before reading the bitmap superblock. This is needed because llbitmapreadsb can initialize a new bitmap and flush it through helpers that use...

CVE-2026-90276: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/md-llbitmap: stop daemon timer rearm on destroy llbitmapdestroy deletes pendingtimer before flushing mdllbitmapiowq. However, daemonwork can still be queued or running after the timer has been deleted, and the daemon path can...

CVE-2026-90400: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md: recheck spare changes before starting sync removespares and removeandaddspares modify the array's rdev configuration. These operations are only safe after the array has been suspended. mdstartsync checks whether spare...

CVE-2026-90279: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/raid5: round bitmap stripes with sector division raid5bitmapsectormap aligns the array range to full RAID5 stripe widths before converting it to component sectors. That width is chunksectors multiplied by the number of data...

CVE-2026-90389: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md: scope memallocnoio to allocation critical sections Storing a memallocnoiosave token in mddev-noioflags lets one task save the token and another task restore it. With concurrent suspend sysfs writes, task A can enter...

PT-2026-94626

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the md stop function where the bitmap is destroyed before mddev detach is called. This sequence causes mddev detach to skip the bitmap ops-wait behind writes operation...

CVE-2026-90275: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/raid1: don't set arrayfrozen in raid1takeover raid1takeover sets conf-arrayfrozen = 1 on the newly-allocated r1conf and nothing ever clears it, so every I/O to the array stalls permanently once waitbarrier sees it stuck at 1...

PT-2026-94623

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the md/raid1 component where the raid1 takeover function incorrectly sets the array frozen variable to 1 on a newly allocated r1conf. Because this value is never...

CVE-2026-90390: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: md/bitmap: resume array on backlogstore error path backlogstore suspends the array before checking whether a write-mostly device exists. If no such device exists, the error path only unlocks reconfigmutex and leaves the array...

PT-2026-93639

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists when loading and unloading a table. This occurs if userspace initiates two concurrent table load ioctls where one succeeds and the other fails. The issue arises...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In md/raid10, there is a issue where memory leaks occur in the MD thread. In raid10run, if setupconf succeeds and raid10run fails before setting ‘mddev-thread’, then the variable ‘conf-thread’ is not freed after the failure. This...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: md/raid5: Fixed a deadlock issue where raid5d waits for MDSBCHANGEPENDING to be cleared. Xiao reported that the lvconvert-raid-takeover.sh test can hang with a small possibility. The root cause is the same as in the commit...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: md: fixed a deadlock between mddevsuspend and flush Bio A deadlock occurs when mddev is suspended while some of the flush Bio operations are still in progress. This is a complex issue. T1: The first flush occurs at the end of...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: md: fixed the UAF issue when iterating the allmddevs list While iterating the allmddevs list from mdnotifyreboot and mdexit, the listforeachentry Safe mechanism is used. This can lead to a race condition with deletint, causing...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: md: The mdstopwrites function is called in mdstop. From the link 1, we can see that raid1d was still running even after the path raiddtr - mdstop - mdstop. Let’s stop writing data first in the destructor, to align with the normal...